security: Fix command injection vulnerability in updater.py

Browse Source

- Add shlex.quote() on all path arguments before subprocess calls (lines 404-407)
- Consolidate duplicated version_compare() function into single module-level utility
- Remove three identical class methods from UpdateCheckThread, LocalPendingUpdateCheckThread, and UpdateManager
- Add comprehensive test suite for updater.py security-critical functionality
- Add requirements-dev.txt with pytest dependency

Addresses critical security findings from flares_audit_report.md:
  S001: Command Injection in Updater (CVSS ~7.5)
  Q001: Duplicated version_compare logic
  T001: Insufficient test coverage for updater.py

...

This commit is contained in:

Hermes committed 2026-11-07 15:14:32 -07:00

1 parent 2e9820336d

commit 516397dd96

7 files changed

+308 -20

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

tests/__init__.py

Whitespace-only changes.